0

We have Comcast Business Class (not the same as Comcast residential) internet service running to our home in to a Comcast-provided SMC D3G-CCR cable modem. This modem is configured to serve DHCP, and has five static IPs. The network address is 77.XX.YY.0/29, and the gateway device (the SMC) is at 77.XX.YY.6. The LAN IP address of the gateway is 10.20.10.1

Attached to this gateway device are two routers, each with DD-WRT. One is 10.20.20.1, the other is 10.20.30.1.

Attached to 20.1 are several dozen computers including a webserver, several other servers, and internet-connected clients. The webserver is named hurricane and is at 10.20.20.90. From outside the network, navigating to 77.XX.YY.6 brings up the website hosted on hurricane, as expected. So far, so good.

The other router, 30.1 has a server attached to it at 30.60 named typhoon, which is intended to be an OpenVPN server.

The problem I'm having is figuring out how to route 77.XX.YY.5 (or something other than .6) to typhoon. Right now when I go to 77.XX.YY.5, all I get is a 404.

I can't have OpenVPN on hurricane because they both will have similar ports serving totally different content.

I think I know that having both the gateway and each of the core routers serving DHCP is likely a problem. But I'm afraid to turn off DHCP on the gateway without knowing really what I'm doing because I'm afraid I'll break things to the point where I'll have to call tech support.

How, in general terms, do I configure my three routers to serve Internet-facing sites the way I intend?

If you have particular experience with static IPs on Comcast Buisness gatways, I'd love specific advice; but all advice is welcomed here.

Improve this question
7
  • None of those IPs you're using internally are the static IPs that Comcast has provided, they are behind NAT. Say they gave you 77.125.125.0/29, that means you have 77.125.125.1 to 77.125.125.6. I highly doubt the SMC cable modem router they gave you can handle a routed block (the manual makes it look like a pretty basic featured home-style router). If you want to route any of the public addresses to the other side of a router, you'll need a real router where you can assign IPs by interface (such as cisco, juniper, ddwrt, tomato, etc)
    – MaQleod
    Apr 15, 2014 at 3:00
  • Maybe I wasn't clear, but the 77.XX.Y.0/29 addresses are the static IPs assigned by comcast. The gateway's public IP is 77.XX.YY.6. I can't change the gateway device, but the two routers onthe other side of that are DD-WRT. Is all I have to do is turn off DHCP on the gateway, and set the WAN IP on the DD-WRT devices to 77.XX.YY.5 and 77.XX.YY.4?
    – John Dibling
    Apr 15, 2014 at 10:26
  • The equipment comcast gave you is not capable of what you want to do. When I worked for an ISP, the equipment we sold to customers in order to do what you're looking to do was $400 minimum (a cisco or samsung router). You're not going to get that out of a cheapo cable modem/router combo. You need to get them to bridge the modem and then get one of your ddwrt routers as the WAN, then set it up to pass the public IPs off to individual interfaces. You should be able to set a few to be on the public IPs, a few on a private DHCP range, and then setup static routes between them.
    – MaQleod
    Apr 15, 2014 at 15:49
  • That's what I tried doing this morning. I turned off DHCP on the comcast device, thinking it would accomplish more or less the same thing. Didn't work though. I had to get tech support to reconfigure the thing so I could get back online. Now I have a ticket open with level 2 support. I;m not sure if the problem was with the comcast device, or how I had my ddwrt configured. I wasn't able to ping the comcast device or see the internet.
    – John Dibling
    Apr 15, 2014 at 16:00
  • Simply turning off DHCP is not putting it in bridged mode. You still have all sorts of other things (like NAT) that are enabled.
    – MaQleod
    Apr 15, 2014 at 16:15

1 Answer 1

Reset to default
0

The DHCP is not the problem if set up correctly (every router assigning "its" space). Your problem is the NAT in your gateway. All of your network members have (and at first only) one local address. NOT a public one. What your gateway (the NAT) does is translating the addresses from the inside to the outside so all of your network members can communicate with the internet. Reaching the local computers from the outside is a bit more complicated. Let's assume you only have one external ip (the 77.x.y.6). This one is occopied by the gateway. You can now (and I think this is the case here) configure a port forward from gateway:80 to hurricane:80 which means if you connect to 77.x.y.6:80 you'll reach hurricane:80 from the outside. [Note: This is surely not "as expected" for your possibilities] Your option here is to set another portforwarding e.g. from gateway:81 to typhoon:80. If you now connect from the outside to that specific port 81 (you'd have to type it every time) you'll reach the webserver of typhoon.

Generally, this is NOT what you want to do (for private use with only one ip it is the common approach). But you have 4 external ip addresses, so use them wisely. Let's say you want that hurricane can be reached trough 77.x.y.7 and typhoon through 77.x.y.8. This is not a portforwarding anymore. You have to tell your NAS (in the gateway) to statically translate 10.20.20.90 (hurricane) to 77.x.y.7. And the same for typhoon: translate 77.x.y.8 to 10.20.30.60. That means that for the outside, hurricane and typhoon become directly reachable because they get something like own unique ip addresses. The servers themselves maybe won't even recognize this. They still only have their one and only local ip address on their interface in your network. All the work is done by the NAS by translating the addresses. I'm not sure if your gateway is able to do this, you should search for static NAS table in the manual.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .